A personal operating system that routes, gates, then hands to the human
A Claude Code plugin where a coordinator routes every request to the right skill or sub-agent, then gates real-world actions through a QA filter and a permissions-tier system before they reach the human.
The largest of my open systems: 8 agents and 10 skills, plus state templates that carry context between sessions. Public and inspectable, and built so that nothing reaches the real world without passing the gate first.
The problem
Running several ventures at once, the bottleneck was not capability, it was coordination and safety. A single general assistant either tried to do everything itself and lost the thread, or it would happily take a real-world action, send a message, change a record, move on a decision, with no checkpoint between the suggestion and the consequence. What was missing was a layer that could route each request to the right specialist and, just as importantly, refuse to let any consequential action through until it had been checked and explicitly permitted.
Approach
The design is a coordinator in front of a set of focused skills and sub-agents, with two gates standing between any agent and a real-world action. The coordinator decides who should handle a request; it does not do the work itself. Before anything leaves the system, it passes a QA filter and a permissions tier. The interesting part is not that it can act, it is that acting is the one thing it is not allowed to do on its own.
- Route, do not do. A coordinator reads each request and hands it to the right skill or sub-agent. The leash: the coordinator dispatches and never improvises the work itself, so each job lands with the specialist built for it.
- Gate every real-world action through QA. A QA filter sits between the agents and any action that touches the outside world. The leash: an action that fails the filter does not go out, full stop.
- Tier the permissions, default to asking. A permissions-tier system decides what may run on its own and what must wait for the human. The leash: anything consequential or irreversible defaults to the human, not the machine.
What was built
A Claude Code plugin made of 8 agents and 10 skills, coordinated by a single router, with state templates that hand context from one session to the next so the system has continuity instead of starting cold each time. The QA filter and the permissions-tier system are the core artifacts: they are what make the routing safe to hand a real decision. A worked-example venture vertical inside the plugin shows the whole pattern end to end, from request, to routing, to gate, to the human.
Guardrails
What the system is structurally not allowed to do. This is the through-line: capability, then leash.
- NoIt cannot take a real-world action that skips the QA filter. Every outward action is checked before it leaves.
- NoIt cannot self-escalate its own permissions tier. Anything consequential defaults to the human.
- NoIt does not act before the human sees it. The gate sits in front of the consequence, not after.
Stack and tools
My role
I designed and built this system end to end, the coordinator, the skills and sub-agents, and the QA and permissions gates that sit in front of every real-world action.
Links and verification
This is an open-source project. The repository is public, so the architecture and guardrails described here can be inspected directly.